Threat database

A security vulnerability in Vim (Vi IMproved) allows arbitrary command execution via a crafted tags file in C omni-completion. This issue is tracked as CVE-2026-73073 and affects Red Hat Enterprise Linux 9 and its extended update support versions. Red Hat has issued an important security advisory and released updated Vim packages to address this flaw.

A security vulnerability (CVE-2026-76561) exists in the pki-core component of Red Hat Certificate System. The certprofile-import functionality in Dogtag/PKI allows code execution due to unsanitized profile content involving the ExternalProcessConstraint. This vulnerability affects Red Hat Enterprise Linux 8 and its Extended Life Cycle variants across multiple architectures. Red Hat has issued an important security update to address this issue.

CVE-2026-42784 is a vulnerability in Sequoia-openpgp version 3.0 involving cryptographic integrity compromise due to key flag confusion. The issue relates to improper handling of key flags that could affect the integrity of cryptographic operations. No CVSS score or detailed impact information is provided.

A vulnerability in libsoup's soup_uri_decode_data_uri() function causes improper handling of base64 data-URI payloads containing embedded NUL bytes. This leads to an uninitialized decoded length value used in the returned GBytes size, resulting in a potential out-of-bounds read or application crash when processing crafted data URIs. The issue is tracked as CVE-2026-102555 with a high severity rating and a CVSS score of 8.2. Red Hat has released security updates addressing this flaw in libsoup3 for Red Hat Enterprise Linux 10 and related products.

A vulnerability identified as CVE-2026-93599 affects rustls-webpki before version 0.103.13, causing a panic triggered by an empty BIT STRING. The affected product version is 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-93600 is a vulnerability in rustls webpki involving a bypass of Name Constraints URI validation. It affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided. No patch or remediation details are currently available.

CVE-2026-93602 is a vulnerability in rustls-webpki before version 0.103.10 that allows bypassing CRL (Certificate Revocation List) revocation checks. This flaw affects version 3.0 of the Microsoft product referencing this component. No CVSS score or detailed impact information is provided.

A vulnerability identified as CVE-2026-93601 affects rustls webpki versions before 0.103.12, specifically version 3.0 of the Microsoft product. The issue involves a Name Constraint Bypass, which relates to certificate validation weaknesses. No CVSS score or detailed impact information is provided. No known exploits are reported in the wild, and no patch information is available in the provided data.

A vulnerability in GIMP's GIMPressionist plugin allows out-of-bounds memory writes when processing specially crafted preset files. This flaw arises from improper validation of vector indices before writing into fixed-size arrays. Exploitation requires user interaction to load a malicious preset file and can lead to application crashes or potentially arbitrary code execution. The issue is tracked as CVE-2026-97185 with a high severity rating and CVSS score of 7.8. Red Hat has issued a security advisory providing patches for affected GIMP versions on Red Hat Enterprise Linux 9.

A heap-based buffer overflow vulnerability exists in the corosync package's totempg assembly buffer during fragmented message reassembly. This vulnerability affects Red Hat Enterprise Linux 8 and related variants. The issue is identified as CVE-2026-81665 and has been rated as having an important security impact by Red Hat. A security update addressing this vulnerability is available.

Pod::Text versions before 6.1.1 for Perl contain a vulnerability that allows CPU and memory exhaustion when formatting a POD document with deeply nested =over directives. This can lead to resource exhaustion during processing.

A vulnerability in OpenTelemetry-Go version 3.0 causes exporter configuration logging to potentially leak endpoint URLs in informational logs. This could expose sensitive endpoint information through logs.