Threat database

CVE-2026-39821 is a vulnerability in golang.org/x/net/idna related to the failure to reject ASCII-only Punycode-encoded labels. This issue affects version 3.0 of the Microsoft product referencing this library. No CVSS score or detailed impact information is provided.

A security update for the Intel SGX SDK in Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including denial of service, arbitrary file overwrite, symlink poisoning, prototype pollution, and path traversal bypass. These issues affect components such as qs, node-tar, and lodash libraries. The update is rated as Important by Red Hat Product Security and includes fixes for CVE-2025-13465 among others. Users are advised to apply the update as detailed in the Red Hat advisory.

A low severity security vulnerability (CVE-2026-39373) affecting the python-jwcrypto package in Red Hat Enterprise Linux 10 has been addressed. The issue involves memory exhaustion caused by crafted compressed JSON Web Encryption (JWE) tokens. Red Hat has released an update for python-jwcrypto to fix this vulnerability. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. No public exploits or in-the-wild exploitation have been reported. The update is available and should be applied to affected systems.

Multiple security vulnerabilities were discovered in the Linux kernel for NVIDIA Tegra systems, including a critical flaw known as EntrySign affecting some AMD Zen processors. This flaw allows improper verification of CPU microcode signatures, potentially enabling a privileged attacker to load malicious microcode, leading to loss of system integrity and confidentiality. The update addresses numerous security issues across a wide range of kernel subsystems and drivers. A patch is available and users are advised to update to the fixed version 6.8.0-1022.22 and reboot their systems.

Red Hat issued a security advisory for a kernel update addressing multiple vulnerabilities in the Linux kernel. The fixes include a use-after-free in page_pool_recycle_in_ring (CVE-2025-38129), a use-after-free in BPF sockmap that can lead to denial of service and privilege escalation (CVE-2025-38154), a NULL dereference in SCTP (CVE-2025-40240), and a BUG() in IPv6 pskb_expand_head (CVE-2025-71085). The update is rated as having moderate security impact. Systems must be rebooted after applying the update for the fixes to take effect.

Red Hat has issued a security advisory for a kernel update addressing three vulnerabilities: a use-after-free in RDMA/rxe (CVE-2025-38024), a NULL dereference in SCTP (CVE-2025-40240), and a BUG() in IPv6 handling (CVE-2025-71085). These flaws affect the Linux kernel core in Red Hat Enterprise Linux 8.2 AUS. The update is rated moderate severity and requires a system reboot to apply.

A denial of service vulnerability exists in the python-pyasn1 library due to memory exhaustion caused by malformed RELATIVE-OID data. This issue affects Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. The vulnerability has been rated as important by Red Hat Product Security. A security update is available to address this issue.