Export limit exceeded: 24810 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24810 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19608 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach. | ||||
| CVE-2026-15713 | 2 Libsoup, Redhat | 3 Libsoup, Enterprise Linux, Rhel Els | 2026-11-06 | 5.9 Medium |
| A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash. | ||||
| CVE-2026-114232 | 2 Red Hat, Redhat | 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more | 2026-11-06 | 8.1 High |
| A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm. | ||||
| CVE-2026-110932 | 2 Red Hat, Redhat | 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more | 2026-11-06 | 7.5 High |
| A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions. | ||||
| CVE-2025-4476 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 4.3 Medium |
| A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authenticate header. Processing this malformed header can lead to a crash of the client application using libsoup. An attacker could exploit this by setting up a malicious HTTP server. If a user's application using the vulnerable libsoup library connects to this malicious server, it could result in a denial-of-service. Successful exploitation requires tricking a user's client application into connecting to the attacker's malicious server. | ||||
| CVE-2026-2443 | 3 Gnome, Red Hat, Redhat | 4 Libsoup, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-06 | 5.3 Medium |
| A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component. | ||||
| CVE-2026-19411 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-06 | 3.9 Low |
| A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader. | ||||
| CVE-2026-18839 | 2 Popt-devel, Redhat | 8 Popt-static, Enterprise Linux, Hardened Images and 5 more | 2026-11-06 | 2.2 Low |
| An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application. | ||||
| CVE-2026-18743 | 2 Redhat, Rpm-software-management | 8 Enterprise Linux, Hardened Images, Hummingbird and 5 more | 2026-11-06 | 2.5 Low |
| A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service). | ||||
| CVE-2026-18739 | 2 Popt-devel, Redhat | 6 Popt-static, Enterprise Linux, Hummingbird and 3 more | 2026-11-06 | 2.5 Low |
| A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data. | ||||
| CVE-2026-17591 | 3 Libarchive, Red Hat, Redhat | 7 Libarchive, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-06 | 3.6 Low |
| A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data. | ||||
| CVE-2026-17072 | 2 Gstreamer, Redhat | 3 Good Plug-ins, Enterprise Linux, Rhel Els | 2026-11-06 | 3.3 Low |
| A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory. | ||||
| CVE-2026-17039 | 1 Redhat | 4 Certificate System, Dogtag Certificate System, Enterprise Linux and 1 more | 2026-11-06 | 3.1 Low |
| A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization. | ||||
| CVE-2026-16517 | 2 Libarchive, Redhat | 7 Libarchive, Enterprise Linux, Hardened Images and 4 more | 2026-11-06 | 2.9 Low |
| A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the addition of the encryption overhead to the entry size overflows int64_t, resulting in undefined behavior. This could lead to incorrect Zip64 extension decisions or potential memory corruption. | ||||
| CVE-2026-1801 | 2 Gnome, Redhat | 3 Libsoup, Enterprise Linux, Rhel Els | 2026-11-06 | 5.3 Medium |
| A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure. | ||||
| CVE-2026-12969 | 3 Dnsmasq, Redhat, Thekelleys | 6 Dnsmasq, Enterprise Linux, Openshift and 3 more | 2026-11-06 | 5.3 Medium |
| An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions. | ||||
| CVE-2026-12547 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-11-06 | 3.4 Low |
| SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials. | ||||
| CVE-2026-12528 | 1 Redhat | 4 389 Directory Server, Directory Server, Enterprise Linux and 1 more | 2026-11-06 | 5.4 Medium |
| A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process. | ||||
| CVE-2026-2243 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more | 2026-11-06 | 5.1 Medium |
| A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS). | ||||
| CVE-2026-2239 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-06 | 2.8 Low |
| A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Document) file. This occurs because the buffer allocated for a Pascal string is not properly null-terminated, leading to an out-of-bounds read when strlen() is subsequently called. Successfully exploiting this vulnerability can cause the application to crash, resulting in an application level Denial of Service. | ||||