Threat database

A weakness in apidevtools json-schema-ref-parser up to version 15.3.5 allows remote attackers to manipulate object prototype attributes improperly via the Refs.set/Pointer.set functions. This vulnerability can lead to limited confidentiality, integrity, and availability impacts. Upgrading to version 15.3.6 addresses this issue.

A security vulnerability (CVE-2026-8450) exists in the perl-HTTP-Daemon package used in Red Hat Enterprise Linux 9. The flaw allows arbitrary code execution via OS command injection in the send_file() function of the HTTP::Daemon class. Red Hat has issued an important security update to address this issue.

A vulnerability in GIMP's PSD parser involves an integer overflow in the read_RLE_channel() function, leading to an undersized heap allocation and subsequent heap memory corruption. This flaw can cause denial of service or arbitrary code execution. A security update addressing this issue is available for Red Hat Enterprise Linux 9.

A directory traversal vulnerability (CVE-2025-67030) exists in the extractFile method of the plexus-utils component used by Maven. This vulnerability could allow an attacker to write files outside the intended directory during extraction. Red Hat has issued a security update for Maven 3.9 in Red Hat Enterprise Linux 9.6 Extended Update Support to address this issue.

A stack buffer overflow vulnerability exists in GIMP's PNM file format parser due to an off-by-one error in the pnmscanner_gettoken() function. This flaw can cause memory corruption when processing specially crafted PNM files, potentially leading to denial of service or arbitrary code execution. The issue has been assigned CVE-2026-58380 with a CVSS score of 7.3 (high severity). Red Hat has released patches for affected versions of GIMP in Red Hat Enterprise Linux 9.

A heap buffer overflow vulnerability exists in GIMP's Paint Shop Pro (PSP) file format parser due to incorrect buffer size calculations when processing low bit-depth images. This flaw allows a remote attacker to cause arbitrary code execution or denial of service by tricking a user into opening a specially crafted PSP image file. The issue is tracked as CVE-2026-58379 with a CVSS score of 7.3 (high severity). Red Hat has released security updates addressing this vulnerability in GIMP packages for Red Hat Enterprise Linux 9.

CVE-2026-14330 is a vulnerability involving multiple unbounded alloca() calls in the PulseAudio protocol server component of PipeWire, a multimedia server for Linux. This flaw can lead to a stack overflow condition. The vulnerability has a CVSS score of 5.5 (medium severity) and impacts availability but not confidentiality or integrity. Red Hat has issued a security advisory with an update for PipeWire in Red Hat Enterprise Linux 9 to address this issue.

A heap use-after-free vulnerability exists in the libblkid library of util-linux during nested partition probing. This flaw occurs because certain partition probers cache raw pointers that become stale after array reallocations, leading to potential memory corruption. An attacker can exploit this by presenting a crafted block device image, triggering the flaw automatically via udev/udisks without user interaction. The impact includes limited information disclosure or denial of service. Red Hat has released patches to address this issue in their util-linux packages.

A security vulnerability (CVE-2026-9256) affecting the ngx_http_rewrite_module of nginx in Red Hat Enterprise Linux 10 allows for potential code execution and denial of service. Red Hat has issued an important security advisory with an update to address this issue. The vulnerability impacts multiple architectures and product variants of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder packages. The advisory references a fix available in updated nginx packages.