Threat database

A vulnerability in OpenTelemetry-Go version 3.0 causes exporter configuration logging to potentially leak endpoint URLs in informational logs. This could expose sensitive endpoint information through logs.

A vulnerability in containerd CRI version 3.0 causes a Goroutine leak during ExecSync operations, which can lead to node-level denial of service.

A vulnerability in GIMP's Lighting Effects filter allows improper validation of the number of light sources when processing a specially crafted lighting preset file. This flaw can cause an out-of-bounds write leading to memory corruption. Exploitation requires user interaction by opening a malicious preset file and may result in a crash or arbitrary code execution. A security update addressing this issue is available from Red Hat for their Enterprise Linux 9 distributions.

A heap-based buffer overflow vulnerability exists in GIMP's ICO file loader due to an integer overflow when processing embedded PNG images. This flaw can be triggered by opening a crafted malicious ICO file, potentially leading to arbitrary code execution or application crash. The vulnerability has a high severity score and affects certain Red Hat Enterprise Linux 9 distributions. A security update addressing this issue is available from Red Hat.

A moderate severity security vulnerability (CVE-2026-42533) affecting nginx version 1.24 on Red Hat Enterprise Linux 9 allows arbitrary code execution via crafted HTTP requests. Red Hat has released an update to address this issue. The vulnerability impacts multiple architectures supported by Red Hat Enterprise Linux 9. No public exploit or confirmed exploitation in the wild is reported.

Red Hat has issued a security advisory for the Node.js 22 module in Red Hat Enterprise Linux 8 addressing multiple vulnerabilities. These include unauthorized filesystem access due to a permission model enforcement flaw (CVE-2026-58043), remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846), and a heap-use-after-free vulnerability in HTTP/2 handling that can lead to denial of service (CVE-2026-56848). The update is rated as Important by Red Hat Product Security. The advisory provides a security update to mitigate these issues.

Two security vulnerabilities have been identified in nginx version 1.26 used in Red Hat Enterprise Linux 9. These include a heap buffer over-read that can lead to memory modification or denial of service (CVE-2026-56434), and a memory disclosure and denial of service issue in the ngx_http_slice_module (CVE-2026-60005). Red Hat has released security updates addressing these issues.

Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine. These include arbitrary JavaScript execution in PDF.js, unexpected process crashes, memory corruption, sandbox escape, sensitive data leakage, clipboard hijacking, and disclosure of process memory. These issues arise from maliciously crafted web content and pose risks such as denial of service, information disclosure, and potential privilege escalation. Red Hat has released security updates addressing these vulnerabilities in webkit2gtk3 for Red Hat Enterprise Linux 8.8 variants.