Search: 16.5-2

CVE-2026-89088 is a heap-based buffer overflow vulnerability in libparted's file system resizing logic for FAT16 volumes on Red Hat Enterprise Linux 10. It can cause memory corruption leading to application crashes and denial of service when resizing a specially crafted FAT16 file system image with malformed directory metadata. Exploitation requires local user interaction during an administrative partition resizing operation. The vulnerability does not allow remote code execution or privilege escalation under default configurations.

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

CVE-2026-68498 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.16.0 onward. It involves uncontrolled resource consumption due to improper enforcement of the maxNameLength constraint when parsing JSON property names from character-based inputs (e.g., String, Reader, char[]). This allows an attacker to cause excessive memory allocation, potentially exhausting heap memory and crashing the process. Byte-input parsers are not affected. The issue arises because the name length check is delayed until after a large buffer allocation, exceeding the intended limit. No authentication is required, and the default configuration is vulnerable.

Frappe HRMS versions prior to 15.58.3 and between 16.0.0 and before 16.4.3 contain a missing authorization vulnerability in their PWA API endpoints. Authenticated users can access employee data records belonging to other employees without proper authorization. This vulnerability allows unauthorized disclosure of sensitive HR data. The issue is fixed in versions 15.58.3 and 16.4.3.

CVE-2026-55796 is an SQL injection vulnerability in the Salary Payments via ECS report of Frappe HRMS. Versions prior to 15.60.3 and between 16.0.0 and before 16.7.1 allow authenticated HR users to inject SQL via crafted report filter values. This can lead to unauthorized access to sensitive database records. The issue is fixed in versions 15.60.3 and 16.7.1.

CVE-2026-108373 is a missing authorization vulnerability in ERPNext affecting certain endpoints in the Sales Person-wise Transaction Summary report. Versions prior to 15.118.0 and between 16.0.0 and before 16.27.0 do not enforce proper authorization checks, allowing role-limited authenticated users to access financial data beyond their permissions. This issue is fixed in versions 15.118.0 and 16.27.0.

ERPNext versions prior to 15.121.0 and between 16.0.0 and 16.34.0 contain a missing authorization vulnerability. Low-privileged authenticated users can invoke certain state-changing methods without proper permission checks, allowing unauthorized data modification. This issue is resolved in versions 15.121.0 and 16.34.0.

A security advisory from Red Hat addresses multiple vulnerabilities in Red Hat Hardened Images RPMs, including CVE-2026-110263, which involves a denial of service (DoS) vulnerability in the OW2 ASM library. This flaw allows an attacker to cause a stack overflow by providing a specially crafted Java class file with deeply nested generic type signatures, leading to application crashes. The advisory updates maven3.9 RPM packages to version 3.9.16-0.4.hum1. Exploitation requires processing untrusted Java class files, which is uncommon in typical Red Hat deployments where ASM is used on trusted artifacts. No loss of data integrity or confidentiality is reported.

A vulnerability has been identified in libtirpc affecting multiple specific versions. The flaw allows a remote attacker to cause a denial of service (availability impact) but does not affect confidentiality or integrity. The vulnerability requires high attack complexity and user interaction, with no privileges needed. The issue has a medium severity rating with a CVSS score of 5.3.

A vulnerability in libtirpc allows an authenticated remote attacker to cause a denial of service by impacting availability. The flaw affects multiple specific versions of libtirpc, including various Ubuntu package versions. The issue has a medium severity rating with a CVSS score of 6.5. No public exploit code or known exploitation in the wild has been reported. No patch or remediation details are provided in the available data.

A heap buffer overflow vulnerability exists in the stbl_AddSize function of gpac. This flaw can lead to a denial of service due to application crash but does not impact confidentiality or integrity. The issue affects multiple specific versions of gpac as listed. The vulnerability has a medium severity rating with a CVSS score of 5.5.

GPAC MP4Box version 2.4 and several related versions contain a floating point exception vulnerability. This flaw can cause a denial of service by crashing the application when processing crafted input. The vulnerability has a medium severity rating with a CVSS score of 5.5. No public exploits or active exploitation in the wild have been reported. The affected versions include multiple specific builds primarily around version 0.5.2 and 2.2.1 as well as some others listed explicitly.

A vulnerability was found in nfs-utils where the fsidd daemon improperly handles input, leading to a denial of service condition. This flaw affects multiple Ubuntu package versions of nfs-utils. The vulnerability has a medium severity rating with a CVSS score of 5.5, indicating it requires local privileges and can cause service disruption without impacting confidentiality or integrity.

MariaDB server versions from 10.6.1 up to but not including 10.6.28, and specific later versions including 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, contain a vulnerability involving the #mysql50# prefix. This prefix bypasses normal table-name filesystem encoding, allowing attackers to access files using legacy unencoded names. Exploitation can lead to crashes, data corruption, data exfiltration, or remote code execution. The issue is fixed in the specified versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVE-2026-85985 is a medium severity vulnerability affecting specific versions of MariaDB server 10.0 and 10.1 as packaged in various Ubuntu releases. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a network attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability. The affected versions include multiple Ubuntu-specific builds of MariaDB 10.0.20 through 10.0.38 and 10.1.25 through 10.1.40. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the data.

CVE-2026-85748 is a critical vulnerability affecting specific versions of MariaDB 10.0 and 10.1, community-developed forks of MySQL server. The flaw has a very high CVSS score of 9.9, indicating network exploitable with low attack complexity and no user interaction required. It impacts confidentiality, integrity, and availability with a scope change. The affected versions include multiple Ubuntu package builds of MariaDB 10.0 and 10.1. No public exploit or vendor patch information is provided in the data.

CVE-2026-85746 is a critical vulnerability affecting multiple specific versions of MariaDB 10.0 and 10.1, a community-developed fork of MySQL server. The vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. It requires network access with low privileges and no user interaction, and it affects multiple Ubuntu package versions. No public exploits or vendor patch information are provided in the data.

CVE-2026-85745 is a medium severity vulnerability affecting specific versions of MariaDB 10.0 and 10.1 as packaged in various Ubuntu releases. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a low impact on confidentiality with no impact on integrity or availability. It requires network access with low privileges and does not require user interaction. No public exploits or known active exploitation have been reported. The vulnerability affects multiple Ubuntu-specific MariaDB package versions from 10.0.20 through 10.1.40.

CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web caused by assumed-immutable data. It allows an authorized attacker with limited privileges to elevate their privileges over a network. The vulnerability has a medium severity rating with a CVSS score of 5.3. A fix is available in version 4.16.1.