Threat database

CVE-2026-95838 is a denial-of-service vulnerability in containerd version 3.0 caused by repeated opaque whiteouts during the unpacking process. This flaw can lead to resource exhaustion or service disruption.

A vulnerability in the github.com/moby/sys/user package version 3.0 allows for a possible denial of service (DoS) due to unbounded parsing of user and group database files. This could lead to resource exhaustion when processing these files.

A security update for the Linux kernel in Red Hat Enterprise Linux 9.4 addresses a potential use-after-free vulnerability in UDP tunnel segmentation (CVE-2026-74705). This flaw could impact system security due to the kernel's critical role. The update requires a system reboot to take effect and is rated as important by Red Hat Product Security.

A local privilege escalation vulnerability exists in the kbd package's openvt utility due to incorrect process owner verification. This flaw allows an unprivileged user to gain passwordless root login. The issue affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued a security update to address this vulnerability.

A security vulnerability (CVE-2026-73073) affecting Vim (Vi IMproved) allows arbitrary command execution via a crafted tags file in the C omni-completion feature. Red Hat has issued an important security update for Vim in Red Hat Enterprise Linux 8 to address this issue. The vulnerability is rated as having a high severity impact by Red Hat Product Security. No CVSS score is provided in the advisory. The update fixes the flaw by patching the affected Vim packages.

A vulnerability exists in Apache Thrift's Go implementation of THeaderTransport where the inflated size of a ZLIB frame is not bounded. This flaw could potentially lead to resource exhaustion or other issues related to unbounded decompression size. The affected version is 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-63772 is a vulnerability in Apache Thrift Go servers that allows an unauthenticated attacker to cause a server crash with a single packet by exploiting the THeader transform count. The affected version is 3.0. No CVSS score or detailed impact information is provided.

An out-of-bounds read vulnerability exists in the curl project used in Red Hat Hardened Images RPMs. Under specific conditions, the path comparison logic in curl may read outside a heap buffer boundary, potentially causing a crash or allowing a clear-text site to override the contents of a secure cookie. This behavior depends on the memory contents adjacent to the allocation holding the path. The update includes curl version 8.22.0-1.1.hum1 and related packages to address this issue. No mitigation is currently available that meets Red Hat's criteria for ease of use and applicability.

CVE-2026-98174 addresses a vulnerability in the SMB client related to a race condition and missing initialization in the rlist component. The issue affects Microsoft software versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

A security vulnerability (CVE-2026-76561) exists in the pki-core component of Red Hat Certificate System. The certprofile-import functionality in Dogtag/PKI allows code execution due to unsanitized profile content involving the ExternalProcessConstraint. This vulnerability affects Red Hat Enterprise Linux 8 and its Extended Life Cycle variants across multiple architectures. Red Hat has issued an important security update to address this issue.

CVE-2026-42784 is a vulnerability in Sequoia-openpgp version 3.0 involving cryptographic integrity compromise due to key flag confusion. The issue relates to improper handling of key flags that could affect the integrity of cryptographic operations. No CVSS score or detailed impact information is provided.

A vulnerability in libsoup's soup_uri_decode_data_uri() function causes improper handling of base64 data-URI payloads containing embedded NUL bytes. This leads to an uninitialized decoded length value used in the returned GBytes size, resulting in a potential out-of-bounds read or application crash when processing crafted data URIs. The issue is tracked as CVE-2026-102555 with a high severity rating and a CVSS score of 8.2. Red Hat has released security updates addressing this flaw in libsoup3 for Red Hat Enterprise Linux 10 and related products.

A vulnerability identified as CVE-2026-93599 affects rustls-webpki before version 0.103.13, causing a panic triggered by an empty BIT STRING. The affected product version is 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-93600 is a vulnerability in rustls webpki involving a bypass of Name Constraints URI validation. It affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are currently available.

CVE-2026-93602 is a vulnerability in rustls-webpki before version 0.103.10 that allows bypassing CRL (Certificate Revocation List) revocation checks. This flaw affects version 3.0 of the Microsoft product referencing this component. No CVSS score or detailed impact information is provided.