Threat database

A vulnerability identified as CVE-2026-93601 affects rustls webpki versions before 0.103.12, specifically version 3.0 of the Microsoft product. The issue involves a Name Constraint Bypass, which relates to certificate validation weaknesses. No CVSS score or detailed impact information is provided. No known exploits are reported in the wild, and no patch information is available in the provided data.

A vulnerability in GIMP's GIMPressionist plugin allows out-of-bounds memory writes when processing specially crafted preset files. This flaw arises from improper validation of vector indices before writing into fixed-size arrays. Exploitation requires user interaction to load a malicious preset file and can lead to application crashes or potentially arbitrary code execution. The issue is tracked as CVE-2026-97185 with a high severity rating and CVSS score of 7.8. Red Hat has issued a security advisory providing patches for affected GIMP versions on Red Hat Enterprise Linux 9.

Pod::Text versions before 6.1.1 for Perl contain a vulnerability that allows CPU and memory exhaustion when formatting a POD document with deeply nested =over directives. This can lead to resource exhaustion during processing.

A vulnerability in OpenTelemetry-Go version 3.0 causes exporter configuration logging to potentially leak endpoint URLs in informational logs. This could expose sensitive endpoint information through logs.

A vulnerability in containerd CRI version 3.0 causes a Goroutine leak during ExecSync operations, which can lead to node-level denial of service.

A vulnerability in GIMP's Lighting Effects filter allows improper validation of the number of light sources when processing a specially crafted lighting preset file. This flaw can cause an out-of-bounds write leading to memory corruption. Exploitation requires user interaction by opening a malicious preset file and may result in a crash or arbitrary code execution. A security update addressing this issue is available from Red Hat for their Enterprise Linux 9 distributions.

A heap-based buffer overflow vulnerability exists in GIMP's ICO file loader due to an integer overflow when processing embedded PNG images. This flaw can be triggered by opening a crafted malicious ICO file, potentially leading to arbitrary code execution or application crash. The vulnerability has a high severity score and affects certain Red Hat Enterprise Linux 9 distributions. A security update addressing this issue is available from Red Hat.

A moderate severity security vulnerability (CVE-2026-42533) affecting nginx version 1.24 on Red Hat Enterprise Linux 9 allows arbitrary code execution via crafted HTTP requests. Red Hat has released an update to address this issue. The vulnerability impacts multiple architectures supported by Red Hat Enterprise Linux 9. No public exploit or confirmed exploitation in the wild is reported.

Red Hat has issued a security advisory for the Node.js 22 module in Red Hat Enterprise Linux 8 addressing multiple vulnerabilities. These include unauthorized filesystem access due to a permission model enforcement flaw (CVE-2026-58043), remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846), and a heap-use-after-free vulnerability in HTTP/2 handling that can lead to denial of service (CVE-2026-56848). The update is rated as Important by Red Hat Product Security. The advisory provides a security update to mitigate these issues.

Two security vulnerabilities have been identified in nginx version 1.26 used in Red Hat Enterprise Linux 9. These include a heap buffer over-read that can lead to memory modification or denial of service (CVE-2026-56434), and a memory disclosure and denial of service issue in the ngx_http_slice_module (CVE-2026-60005). Red Hat has released security updates addressing these issues.

Multiple security vulnerabilities have been identified in WebKitGTK, the GTK port of the WebKit web rendering engine. These include arbitrary JavaScript execution in PDF.js, unexpected process crashes, memory corruption, sandbox escape, sensitive data leakage, clipboard hijacking, and disclosure of process memory. These issues arise from maliciously crafted web content and pose risks such as denial of service, information disclosure, and potential privilege escalation. Red Hat has released security updates addressing these vulnerabilities in webkit2gtk3 for Red Hat Enterprise Linux 8.8 variants.