Threat database

A vulnerability identified as CVE-2026-98404 affects Microsoft software versions 3.0 and 4.0. It involves a bug in the drm/virtio component, specifically in the virtio_gpu_user_framebuffer_create() function, related to improper handling of NULL versus ERR_PTR() values. No CVSS score or detailed impact information is provided.

This vulnerability, identified as CVE-2026-98409, involves a division by zero issue in the watchdog component for Microsoft products, specifically versions 3.0 and 4.0. The description provided is minimal and does not detail the exploitation method or impact. No CVSS score or detailed technical information is available.

This vulnerability involves the wifi mac80211_hwsim component where frames are improperly handed to mac80211 during the stopping process. The issue affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

CVE-2026-98429 is a vulnerability related to RDMA/efa where EQ resources are kept alive while an IRQ is registered. The advisory does not provide detailed technical information or impact specifics. The affected software versions are Microsoft products version 3.0 and 4.0.

This vulnerability involves the wifi mac80211 component where a warning (WARN) can occur in the set_bitrate_mask function when sdata is not present in the driver. The issue affects specific Microsoft product versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.

This vulnerability involves an IRQ leak caused by using an incorrect index in the MSI-X error path within the mwifiex WiFi driver. It affects Microsoft products with versions 3.0 and 4.0. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation in the wild.

A heap out-of-bounds (OOB) write vulnerability exists in the WiFi RSI component related to key removal in Microsoft software versions 3.0 and 4.0. This flaw could potentially lead to memory corruption.

This vulnerability, identified as CVE-2026-98422, relates to the wifi mac80211 component and involves resetting the AP_VLAN tailroom counter on interface down events. The information provided is minimal and does not include details on the impact or exploitation. The affected versions are Microsoft products version 3.0 and 4.0. No CVSS score or detailed technical impact is available.

A heap-based out-of-bounds read vulnerability exists in unarr through version 1.1.1 within the zip_parse_extra_fields() function due to an incorrect ZIP64 extra field length check. This flaw allows an attacker to craft a malicious ZIP archive with specific sentinel values and a truncated ZIP64 record, causing the process to read beyond the heap buffer and potentially crash.

CVE-2026-63718 is a vulnerability in Apache HTTP Server's mod_proxy_uwsgi module related to Transfer-Encoding response smuggling. The advisory references Microsoft but provides no detailed technical or impact information. The affected version is Apache HTTP Server 3.0. No CVSS score or exploit details are available.

CVE-2026-95838 is a denial-of-service vulnerability in containerd version 3.0 caused by repeated opaque whiteouts during the unpacking process. This flaw can lead to resource exhaustion or service disruption.

A vulnerability in the github.com/moby/sys/user package version 3.0 allows for a possible denial of service (DoS) due to unbounded parsing of user and group database files. This could lead to resource exhaustion when processing these files.

A security update for the Linux kernel in Red Hat Enterprise Linux 9.4 addresses a potential use-after-free vulnerability in UDP tunnel segmentation (CVE-2026-74705). This flaw could impact system security due to the kernel's critical role. The update requires a system reboot to take effect and is rated as important by Red Hat Product Security.

A local privilege escalation vulnerability exists in the kbd package's openvt utility due to incorrect process owner verification. This flaw allows an unprivileged user to gain passwordless root login. The issue affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued a security update to address this vulnerability.

A security vulnerability (CVE-2026-73073) affecting Vim (Vi IMproved) allows arbitrary command execution via a crafted tags file in the C omni-completion feature. Red Hat has issued an important security update for Vim in Red Hat Enterprise Linux 8 to address this issue. The vulnerability is rated as having a high severity impact by Red Hat Product Security. No CVSS score is provided in the advisory. The update fixes the flaw by patching the affected Vim packages.

A vulnerability exists in Apache Thrift's Go implementation of THeaderTransport where the inflated size of a ZLIB frame is not bounded. This flaw could potentially lead to resource exhaustion or other issues related to unbounded decompression size. The affected version is 3.0. No CVSS score or detailed impact information is provided.

CVE-2026-63772 is a vulnerability in Apache Thrift Go servers that allows an unauthenticated attacker to cause a server crash with a single packet by exploiting the THeader transform count. The affected version is 3.0. No CVSS score or detailed impact information is provided.

An out-of-bounds read vulnerability exists in the curl project used in Red Hat Hardened Images RPMs. Under specific conditions, the path comparison logic in curl may read outside a heap buffer boundary, potentially causing a crash or allowing a clear-text site to override the contents of a secure cookie. This behavior depends on the memory contents adjacent to the allocation holding the path. The update includes curl version 8.22.0-1.1.hum1 and related packages to address this issue. No mitigation is currently available that meets Red Hat's criteria for ease of use and applicability.

CVE-2026-98174 addresses a vulnerability in the SMB client related to a race condition and missing initialization in the rlist component. The issue affects Microsoft software versions 3.0 and 4.0. No CVSS score or detailed impact information is provided.