Threat database

CVE-2026-13322 is a vulnerability in Kubevirt's virt-handler component on RHEL9 where an unbounded virtio-serial readline can cause an out-of-memory (OOM) denial of service condition. This flaw could allow an attacker to exhaust system memory, leading to service disruption.

SQLite contains a vulnerability in the FTS5 full-text search extension where certain memory operations are incorrectly handled. This flaw can be exploited by an attacker to cause SQLite to crash, leading to a denial of service, or potentially to execute arbitrary code. Multiple Ubuntu package versions are affected, and fixed versions have been released.

A heap buffer under-read vulnerability (CVE-2025-5278) exists in the GNU Coreutils sort utility as packaged in Red Hat Enterprise Linux 10. This flaw involves improper handling of key specifications during sorting operations. Red Hat has issued a security update to address this moderate severity issue. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 10, including Extended Update Support and Extended Life Cycle versions.

CVE-2026-34892 is a missing authorization vulnerability in Rank Math SEO versions prior to 1.0.271.1. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fixed version 1.0.271.1 is available to address this issue.

CVE-2026-10722 is an integer overflow vulnerability in the cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec component. The vulnerability affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided in the available data.

CVE-2026-39828 is a vulnerability involving the bypass of certificate restrictions in the golang.org/x/crypto/ssh package. The information provided is limited and does not include details on the impact, exploitation, or remediation status. The affected version explicitly stated is version 3.0.

A vulnerability identified as CVE-2026-39834 involves invoking an infinite loop when performing large channel writes in the golang.org/x/crypto/ssh package, specifically affecting version 3.0. The issue was published on May 27, 2026. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-39835 involves invoking a server panic during the CheckHostKey/Authenticate process in the golang.org/x/crypto/ssh package. The affected version is 3.0. No CVSS score or detailed impact information is provided.

A vulnerability in golang.org/x/crypto/ssh version 3.0 allows invoking a memory leak when rejecting channels, which can lead to a denial of service (DoS). This issue is identified as CVE-2026-39827 and is associated with CWE-924. No patch or fix information is currently provided.

CVE-2026-39831 is a vulnerability involving the bypass of physical interaction requirements for FIDO/U2F security keys in the golang.org/x/crypto/ssh package. The advisory references Microsoft but provides no detailed technical or impact information. The affected version is exactly 3.0. No CVSS score or exploit details are available.

A vulnerability in golang.org/x/crypto/ssh version 3.0 causes an underflow and panic when invoking byte arithmetic. This issue may lead to unexpected application crashes.

A vulnerability in golang.org/x/crypto/ssh version 3.0 can cause a server deadlock when the client sends unexpected responses. This issue may impact server availability by causing it to become unresponsive.

A vulnerability identified as CVE-2026-39829 exists in golang.org/x/crypto/ssh where invoking pathological RSA/DSA parameters may cause a denial of service (DoS). The advisory references Microsoft Security Response Center but does not provide detailed technical or remediation information. The affected version explicitly stated is version 3.0. No CVSS score or exploit in the wild is reported.

A vulnerability exists in golang.org/x/net/html related to incorrect handling of character references in DOCTYPE nodes. This issue is identified as CVE-2026-25681 and affects version 3.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation or available patches.

A vulnerability identified as CVE-2026-27136 exists in the golang.org/x/net/html package version 3.0, where invoking duplicate attributes can lead to cross-site scripting (XSS). The issue was published on May 27, 2026. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-42502 involves incorrect handling of HTML elements in foreign content within the golang.org/x/net/html package. The issue is associated with Microsoft and affects version 3.0 of the product. No detailed technical or impact information is provided beyond the identification of the flaw.

CVE-2026-39824 is a vulnerability involving an integer overflow in the NewNTUnicodeString function within the golang.org/x/sys/windows package. The issue is identified as CWE-190, which relates to integer overflow or wraparound. The affected version is exactly version 3.0. No CVSS score or detailed impact information is provided, and no known exploits or patches are currently documented.

A denial of service vulnerability exists in golang.org/x/net/html version 3.0 when parsing arbitrary HTML. This flaw could allow an attacker to cause a denial of service by triggering excessive resource consumption during HTML parsing.

A vulnerability exists in golang.org/x/net/html related to incorrect handling of namespaced elements in foreign content. This issue affects version 3.0 of the product. No CVSS score or detailed impact information is provided.