Complete feed

Security advisories & CVEs

4209 advisories across 32 monitored vendors.

Home overview

Critical

CISA KEV

event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites. Red Hat rates this important (CVSS 7). Weakness: CWE-59. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

CVE-2026-54230

Red Hat Enterprise Linux

May 4, 2026

Medium4.8Linux

timing attack allows a bypass of digest authentication

timing attack allows a bypass of digest authentication. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-208. Affected package(s): httpd-main. Resolved in Red Hat advisory RHSA-2026:17080 — update the affected packages (`sudo dnf update`).

event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

timing attack allows a bypass of digest authentication

NULL pointer dereference can cause a child process crash

HTTP response splitting forwarding malicious status line

Privilege Escalation via .htaccess file manipulation

Information disclosure via ServerSideDiff allows reading Kubernetes Secret data

integer overflow via large username or password arguments

HTTP Request Smuggling via Duplicate Content-Length Headers

Denial of Service due to memory exhaustion via WebSocket permessage-deflate compression

Denial of Service via uncontrolled memory growth in WebSocket connections

Denial of Service via oversized HTTP/2 frames

Unauthorized cross-project access due to improper validation in EC2 credential creation

OpenStack ironic-python-agent: Arbitrary code execution via malicious image

pass helper to expect cleanup

reject zero-length fixed buffer import

fix use-after-free in add_adev() error path

validate LTK enc_size on load

fix out-of-bounds read in wacom_intuos_bt_irq

fix race conditions in sco_sock_connect()

fix stack buffer overflow in hci_le_big_create_sync

event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

timing attack allows a bypass of digest authentication

NULL pointer dereference can cause a child process crash

HTTP response splitting forwarding malicious status line

Privilege Escalation via .htaccess file manipulation

Information disclosure via ServerSideDiff allows reading Kubernetes Secret data

integer overflow via large username or password arguments

HTTP Request Smuggling via Duplicate Content-Length Headers

Denial of Service due to memory exhaustion via WebSocket permessage-deflate compression

Denial of Service via uncontrolled memory growth in WebSocket connections

Denial of Service via oversized HTTP/2 frames

Unauthorized cross-project access due to improper validation in EC2 credential creation

OpenStack ironic-python-agent: Arbitrary code execution via malicious image

pass helper to expect cleanup

reject zero-length fixed buffer import

fix use-after-free in add_adev() error path

validate LTK enc_size on load

fix out-of-bounds read in wacom_intuos_bt_irq

fix race conditions in sco_sock_connect()

fix stack buffer overflow in hci_le_big_create_sync