Multiple security vulnerabilities have been identified in nginx, a widely used web and proxy server. These include code execution, denial of service, heap-based buffer overflow, heap buffer over-read, and memory disclosure issues affecting various nginx modules such as ngx_http_rewrite_module, HTTP/2 header processing, and ngx_http_slice_module. Red Hat has released security updates addressing these vulnerabilities in Red Hat Enterprise Linux 9.2 and related products.
.NET 8.0 on Red Hat Enterprise Linux contains security vulnerabilities including an out-of-bounds write in the Google Brotli decoder (CVE-2026-111497) and an elevation of privilege vulnerability in ASP.NET Core (CVE-2026-114148). These issues have been addressed in updated SDK and runtime packages. The update is rated as Important by Red Hat Product Security.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities have been identified in the libsoup HTTP client and server library for GNOME. These vulnerabilities arise from WebSocket handling issues including Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued security updates addressing these flaws in Red Hat Enterprise Linux 8.8 variants.
Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 8.8. These include denial of service via use-after-free, arbitrary code execution through various buffer overflows, data integrity issues from integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update addresses these issues with security patches and bug fixes.
A vulnerability in ip_stack allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation could result in a denial of service condition.
A vulnerability in the Modem component allows an out of bounds read due to an integer overflow. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on a user equipment (UE) device without requiring user interaction or additional privileges.
A logic error in the modem application can cause it to crash, potentially leading to a remote denial of service (DoS). Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker.
An integer overflow vulnerability exists in the modem component that could allow a remote denial of service (DoS) attack. Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker. No additional execution privileges are needed for the attack.
A vulnerability in the Modem component allows a possible escalation of privilege due to a permissions bypass. This issue could enable local privilege escalation if an attacker already has System-level privileges. Exploitation does not require user interaction. A patch is referenced by IDs ALPS09608864 and ALPS09327759.
A vulnerability in the modem component allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. The exploitation could result in a denial of service condition.
CVE-2026-20591 is a vulnerability in GPU pdma involving a missing permission check that allows local escalation of privilege without requiring additional execution privileges or user interaction.
A vulnerability in the Modem component allows a possible out-of-bounds write due to a missing bounds check. This flaw could enable local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. No affected versions or patch information are provided.
A vulnerability in the modem component allows an out of bounds read due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on the user equipment (UE) without requiring user interaction or additional privileges.
A vulnerability in the Modem component allows for possible local escalation of privilege due to a missing permission check. Exploitation does not require user interaction but requires the attacker to have already obtained System privilege.
A vulnerability in neuropilot involves a possible out of bounds write caused by a missing bounds check. This flaw could allow local escalation of privilege if an attacker already has System privilege. Exploitation does not require user interaction. No patch information is currently provided.
A vulnerability in the modem component allows an application crash due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker, potentially causing a denial of service condition.