Threat database

A vulnerability in Grafana allows plugin archive extraction to escape the intended plugin directory, enabling code execution. This issue affects Grafana versions used in Red Hat Enterprise Linux 8 distributions. A security update addressing this flaw is available from Red Hat.

A denial of service vulnerability exists in the perl-Net-DNS package used in Red Hat Enterprise Linux 9. The flaw involves unbounded recursion triggered by misplaced TSIG records during DNS resolution. This can cause the affected system to become unresponsive or crash when processing crafted DNS queries.

This entry references multiple vulnerabilities in the Linux kernel as used in Debian. The Linux kernel is the core component of the Linux operating system. No specific details about the vulnerabilities, affected versions, or impacts are provided.

A heap-based buffer overflow vulnerability exists in the corosync package used by Red Hat Enterprise Linux 10. This flaw occurs during fragmented message reassembly in the totempg assembly buffer. Red Hat has issued an important security update to address this issue.

A vulnerability in GIMP's file-psd plugin causes an integer overflow when generating thumbnail previews for specially crafted PSD files. This leads to a heap-based buffer overflow that can crash the application or allow arbitrary code execution. Exploitation requires navigating to a directory containing the malicious PSD file using GIMP's file chooser, without needing to open the file. Default security features in Red Hat Enterprise Linux mitigate the risk of exploitation.

A denial of service vulnerability exists in the Qt software toolkit, specifically in the qt6-qtbase component. The flaw can be triggered by an excessively large HTTP Cache-Control header, causing the application to become unresponsive or crash. This issue affects Red Hat Enterprise Linux 10.2 Extended Update Support and related builds. A security update addressing this vulnerability has been released by Red Hat.

A vulnerability in Podman allows an attacker to write arbitrary files on the host system by supplying a specially crafted OCI archive to the podman load command. The attack executes with the privileges of the user running Podman. This issue is relevant when untrusted OCI archives are processed. No effective mitigation or patch currently meets Red Hat's criteria for ease of use and deployment.

Multiple vulnerabilities in GIMP plugins allow for code execution and denial of service (DoS). These include out-of-bounds writes and heap-based buffer overflows triggered by crafted preset files or malformed image data. The issues affect various plugins such as the lighting effects plugin, ICO loader, PSD thumbnail generator, and GIMPressionist plugin. Red Hat has released security updates addressing these flaws in Red Hat Enterprise Linux 9.

A vulnerability in Grafana's Unified Alerting component allows an attacker to bypass security controls and disclose information. This issue affects Grafana versions up to and including 12.4.0. The vulnerability has been addressed in version 12.4.0. Red Hat has issued an important security advisory and released updates for affected Red Hat Enterprise Linux distributions.

A command injection vulnerability exists in rpmuncompress, allowing a local attacker to execute arbitrary commands by processing specially crafted archive filenames containing unescaped shell metacharacters. Exploitation requires user interaction, such as invoking rpmuncompress on a malicious file, and can lead to high impact on confidentiality, integrity, and availability of data accessible to the user.

A command injection vulnerability exists in rpm when processing tarball paths or filenames via the rpmbuild -t* command. This flaw allows an attacker to execute arbitrary commands with the build user's privileges by including shell metacharacters in artifact names, particularly impacting automated build or CI workflows. A security update from Red Hat addresses this issue in their Hardened Images RPM packages.

OpenStack Aodh versions before 22.0.1 contain a vulnerability in the alarm list API where project scoping is bypassed if the all_projects query parameter is set to false. This flaw allows non-admin users with reader roles to list alarms across all projects, exposing sensitive information such as webhook URLs, Heat signal endpoints, project IDs, and user IDs. Additionally, OpenStack Watcher's webhook trigger endpoint lacks authorization enforcement since its introduction, enabling any authenticated user who obtains a webhook URL to trigger audits and action plans regardless of their permissions.

Multiple vulnerabilities have been identified in the FFmpeg project, which is a collection of free programs and libraries for handling digital video and audio content, including the libavcodec codec library. The vulnerabilities affect the Fedora product as reported by the Bundesamt für Sicherheit in der Informationstechnik. No specific details about the nature, impact, or affected versions of these vulnerabilities are provided.

A denial of service vulnerability has been identified in Expat, an XML parser written in C. The vulnerability is tracked as CVE-2026-66046 and affects Red Hat Hardened Images RPMs. Red Hat has released an update to address this issue in expat version 2.8.4-0.1.hum1. No public exploit or active exploitation is currently known.

This entry references multiple vulnerabilities in the Linux kernel, which is the core component of the Linux operating system. No specific details about the nature, impact, or affected versions of these vulnerabilities are provided.

Multiple security vulnerabilities were identified and fixed in the Linux kernel, affecting various architectures and subsystems. These include a null pointer dereference in the i.MX clock driver that could cause denial of service, and a memory protection bypass on some ARM processors that could lead to privilege escalation. The issues impact a wide range of kernel components and drivers. Updates addressing these flaws have been released.

Multiple unspecified vulnerabilities have been identified in the Linux kernel, which is the core component of the Linux operating system. The details about the nature of these vulnerabilities, their impact, and affected versions are not provided.

Multiple vulnerabilities have been identified in FFmpeg, an open-source project providing programs and libraries for digital video and audio processing, including the libavcodec codec collection. These vulnerabilities affect versions prior to 9.0 and version 9.0 itself. A fix is available in version 9.0.

Multiple security vulnerabilities have been identified in Red Hat Hardened Images RPMs for Node.js versions 24 and 26. These vulnerabilities are addressed in updated packages released by Red Hat. The advisories list numerous CVEs affecting these Node.js builds, with fixes included in the updated RPM versions.

Multiple vulnerabilities have been identified in FFmpeg, an open-source project providing programs and libraries for digital video and audio processing. These include arbitrary code execution, information disclosure, denial of service, and memory corruption triggered by crafted audio and video files. The affected versions are up to and including 8.1.2. Red Hat has issued security advisories with backported fixes addressing these issues in their Enterprise Linux AI 3.3 packages.