Filtered by vendor Redhat Subscriptions
Total 24807 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96442 2 Gnu, Redhat 3 Emacs, Enterprise Linux, Rhel Els 2026-11-12 7.8 High
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
CVE-2023-41175 3 Fedoraproject, Libtiff, Redhat 4 Fedora, Libtiff, Enterprise Linux and 1 more 2026-11-12 6.5 Medium
A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
CVE-2026-109832 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Eus 2026-11-12 7.5 High
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
CVE-2025-11395 2 Red Hat, Redhat 9 Enterprise Linux, Enterprise Linux, Hardened Images and 6 more 2026-11-12 5.5 Medium
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.
CVE-2026-119777 2 Red Hat, Redhat 4 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 1 more 2026-11-12 8.8 High
A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.
CVE-2026-86564 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Fast Datapath For Rhel 10 and 5 more 2026-11-12 3.3 Low
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
CVE-2026-123747 1 Redhat 1 Enterprise Linux 2026-11-11 7.3 High
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal flaw by submitting filenames containing path traversal sequences. This allows the attacker to upload or delete arbitrary files on the system, which can result in data corruption, denial of service, or arbitrary command execution.
CVE-2026-95619 1 Redhat 8 Enterprise Linux, Hardened Images, Hummingbird and 5 more 2026-11-11 7.7 High
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
CVE-2026-102010 2 Gnu, Redhat 10 Gcc, Enterprise Linux, Enterprise Linux Eus and 7 more 2026-11-11 7 High
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
CVE-2026-96280 2 Flatpak, Redhat 9 Flatpak, Enterprise Linux, Enterprise Linux Eus and 6 more 2026-11-11 7.5 High
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
CVE-2026-91147 1 Redhat 4 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces and 1 more 2026-11-11 5.9 Medium
A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.
CVE-2026-76235 1 Redhat 4 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces and 1 more 2026-11-11 7.5 High
A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.
CVE-2026-85013 2 Red Hat, Redhat 6 Enterprise Linux, Enterprise Linux, Hardened Images and 3 more 2026-11-11 7.3 High
A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.
CVE-2026-92747 1 Redhat 1 Enterprise Linux 2026-11-11 5 Medium
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.
CVE-2026-92768 1 Redhat 1 Enterprise Linux 2026-11-11 5.5 Medium
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.
CVE-2026-92745 1 Redhat 1 Enterprise Linux 2026-11-11 5 Medium
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.
CVE-2026-96577 2 Oc-mirror, Redhat 3 Oc-mirror, Assisted Installer, Openshift 2026-11-11 7.1 High
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed service to push tampered container images, delete cached images, or access mirrored content.
CVE-2026-84725 1 Redhat 2 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els 2026-11-11 8.1 High
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.
CVE-2026-86476 2 Red Hat, Redhat 4 Enterprise Linux, Enterprise Linux, Enterprise Linux Eus and 1 more 2026-11-11 8.4 High
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process.
CVE-2026-96275 2 Flatpak, Redhat 9 Flatpak, Enterprise Linux, Enterprise Linux Eus and 6 more 2026-11-11 8.8 High
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.