Export limit exceeded: 24258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24258 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84708 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 8.7 High |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. A user with the delegated Instance Group Admin role on a container group can set a free-form pod specification override that is deep-merged, without filtering, into every job pod launched on that group. The only hardening applied is forcing automountServiceAccountToken to false, which does not remove an explicitly declared projected serviceAccountToken volume or secret volume mounts. A non-superuser can therefore cause the kubelet to mint a ServiceAccount token for the control-plane automation-controller service account into the job container and mount arbitrary secrets from the control-plane namespace, obtaining the control-plane service-account identity on the Kubernetes API and cleartext control-plane secrets (including the platform database password and Django SECRET_KEY), leading to full platform data compromise. | ||||
| CVE-2026-84709 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 4.9 Medium |
| A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration count, output size, or execution time. An authenticated superuser can submit a credential type whose injector contains deeply nested loops or large string operations, consuming CPU and wall-clock time in the web worker until it is killed by the request timeout; issuing enough concurrent requests places all web workers into a kill-and-respawn loop, making the Controller API and UI unavailable for the duration of the attack. Additionally, certain template constructs raise exception types that the validator does not handle, resulting in an unhandled server error (HTTP 500) instead of a clean validation error. The rendering sandbox prevents code execution, so there is no confidentiality or integrity impact. | ||||
| CVE-2026-84638 | 1 Redhat | 1 Ansible Automation Platform | 2026-09-23 | 9.9 Critical |
| A flaw was found in Red Hat Ansible Automation Platform's automation- controller. When attaching an instance group to a schedule or a workflow job template node through the dedicated API relationship endpoint, the controller verifies only that the requesting user can read (view) the instance group, rather than that they hold use permission on it, unlike every other instance group assignment in the product. An authenticated user with read-only visibility of an instance group -- for example a system auditor -- can attach a use-restricted instance group, including the control plane group or another tenant's container group, to a schedule or workflow node they control. Their playbook then executes on the control plane node or within another tenant's execution environment, leading to privilege escalation and, in the control plane case, full compromise of the platform. | ||||
| CVE-2026-93676 | 1 Redhat | 1 Enterprise Linux | 2026-09-22 | 3.2 Low |
| xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications. | ||||
| CVE-2026-87766 | 1 Redhat | 3 Enterprise Linux, Hardened Images, Hummingbird | 2026-09-22 | 8.8 High |
| A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0. | ||||
| CVE-2026-93573 | 2 Io.netty, Redhat | 21 Netty-codec-http, Amq Broker, Amq Clients and 18 more | 2026-09-22 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context. | ||||
| CVE-2026-93558 | 2 Io.netty, Redhat | 22 Netty-codec-http, Amq Broker, Amq Broker 7 and 19 more | 2026-09-22 | 7.5 High |
| A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server. | ||||
| CVE-2026-93488 | 2 Io.netty, Redhat | 21 Netty-codec-http, Amq Broker, Amq Clients and 18 more | 2026-09-22 | 7.5 High |
| A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service. | ||||
| CVE-2026-18508 | 2 Gnu, Redhat | 8 Tar, Discovery, Enterprise Linux and 5 more | 2026-09-22 | 4.4 Medium |
| A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. | ||||
| CVE-2026-18477 | 2 Gnu, Redhat | 8 Tar, Discovery, Enterprise Linux and 5 more | 2026-09-22 | 4.4 Medium |
| A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue. | ||||
| CVE-2026-5704 | 2 Gnu, Redhat | 6 Tar, Discovery, Enterprise Linux and 3 more | 2026-09-22 | 5 Medium |
| A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | ||||
| CVE-2026-93562 | 2 Io.netty, Redhat | 21 Netty-codec-http, Amq Broker, Amq Clients and 18 more | 2026-09-22 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. | ||||
| CVE-2026-92599 | 2 Hapijs, Redhat | 2 Joi, Hummingbird | 2026-09-22 | 7.5 High |
| joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi. | ||||
| CVE-2026-93492 | 2 Io.netty, Redhat | 21 Netty-codec-http2, Amq Broker, Amq Broker 7 and 18 more | 2026-09-22 | 5.3 Medium |
| A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS). | ||||
| CVE-2026-59849 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 3.1 Low |
| A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service. | ||||
| CVE-2026-59842 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 3.7 Low |
| A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory. | ||||
| CVE-2026-15370 | 2 Libssh, Redhat | 12 Libssh, Enterprise Linux, Enterprise Linux For Els and 9 more | 2026-09-22 | 6.7 Medium |
| A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server. | ||||
| CVE-2026-95508 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-09-22 | 7.4 High |
| A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected. | ||||
| CVE-2026-94640 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-09-22 | 7.5 High |
| A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability. | ||||
| CVE-2026-13087 | 1 Redhat | 3 Enterprise Linux, Enterprise Linux For Nvidia 26, Enterprise Linux Nvidia | 2026-09-22 | 8.8 High |
| A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap overflow. This can lead to denial of service via kernel crash or potential code execution through corruption of adjacent kernel heap objects. | ||||