Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Advisory [CVE-2026-64240] fix control request setup packet
In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix control request setup packet Commit eac69475b01f ("media: rc: igorplugusb: heed coherency rules") changed the control request storage from an embedded struct to an allocated pointer so it can obey DMA coherency rules. However, the driver still passes &ir->request to usb_fill_control_urb(). That points the URB setup packet at the pointer field itself rather than at the allocated struct usb_ctrlrequest. USB core then interprets pointer bytes as the setup packet. This can produce an invalid bRequestType and trigger the control direction warning reported by syzbot: usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 Pass ir->request itself as the setup packet. As a result, the USB core misinterprets the data, leading to an invalid request type and triggering a control direction warning. This issue could potentially cause a denial of service for the affected USB device. Red Hat severity: not rated. Weakness: CWE-843. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Critical [CVE-2026-44210] Privilege escalation and information disclosure via command-line argument injection
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow. Version 3.31.0 patches the issue. A user with privileges to create pods can inject malicious command-line arguments into the virtiofsd process, which manages shared file systems. When combined with another default configuration, this vulnerability allows an attacker to read and write any file on the host system, leading to significant information disclosure and potential privilege escalation. Red Hat severity: Important — CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-88. Affected Red Hat products: Red Hat OpenShift Container Platform 4.
High [CVE-2026-16804] Sandbox escape via crafted HTML page
Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) This can be achieved by enticing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to perform a sandbox escape, potentially gaining elevated privileges or further access to the underlying system. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-787.
High [CVE-2026-16805] Use after free in Blink
Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) An use after free flaw was found in the Blink component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-16806] Arbitrary code execution via use after free vulnerability in WebMCP
Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) This can occur when a user visits a specially crafted HTML page, potentially leading to unauthorized control over the affected system. This vulnerability is rated Important as it allows a remote attacker to achieve arbitrary code execution within the Chromium browser's sandbox. The flaw, a use-after-free in the WebMCP component, is triggered when a user navigates to a specially crafted HTML page, posing a significant risk of unauthorized system control. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
High [CVE-2026-16807] Sandbox escape via crafted HTML page
Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) A flaw was found in the Codecs component of Google Chrome. This could potentially allow the attacker to bypass security restrictions and gain unauthorized access to the underlying system. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787.
High [CVE-2026-60122] Arbitrary OS command execution via code injection in gpsprof utility
Arbitrary OS command execution via code injection in gpsprof utility. Red Hat rates this important (CVSS 7.8). Weakness: CWE-78. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: gpsd-minimal.
High [CVE-2026-14257] Denial of Service via memory exhaustion in expand function
Denial of Service via memory exhaustion in expand() function. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:45381 with package nodejs26-main-26.5.0-1.4.hum1, grafana12-4-main-12.4.6-0.4.hum1, nodejs22-main-22.23.1-2.3.hum1, nodejs24-main-24.18.0-0.5.hum1.
High [CVE-2026-19496] SQL injection (CWE-89) in query parameter filtering — unsanitised user input interpolated into WHERE clause
SQL injection (CWE-89) in query parameter filtering — unsanitised user input interpolated into WHERE clause. Red Hat rates this important (CVSS 8.8). Weakness: CWE-89.
Medium [CVE-2026-65706] Arbitrary Code Execution via Crafted Video Frame
FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() function reuses a temporary row buffer sized for plane 0's single-byte pixel step across all planes, causing an 18-byte memcpy into a 17-byte heap allocation when processing the two-byte-per-sample interleaved chroma plane of a 17x16 NV12 frame, resulting in heap corruption and process crash with potential for code execution. A flaw was found in FFmpeg. By providing a specially crafted NV12 video frame with specific dimensions, a local user can trigger a memory corruption, leading to a process crash. This could potentially result in arbitrary code execution, compromising the system's confidentiality, integrity, and availability. Red Hat Enterprise Linux has multiple layers of heap protection. NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-65705] Arbitrary code execution via out-of-bounds write in vf_floodfill video filter
FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinit_filter 0. When config_input() allocates the points traversal stack based on initial frame dimensions and a subsequent larger frame is processed, filter_frame() performs flood-fill neighbor pushes beyond the original allocation boundary, resulting in heap corruption and process crash with potential for code execution depending on heap layout and process hardening. A flaw was found in FFmpeg. An attacker could exploit this by providing a malicious video stream, which, when processed with filtergraph reinitialization disabled, causes heap memory corruption. This can lead to a denial of service due to a process crash, and in some cases, may enable arbitrary code execution. Red Hat Enterprise Linux has multiple layers of heap protection. NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-65704] Heap corruption via crafted ffconcat file can lead to arbitrary code execution
FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shorten_decode_frame(), where conversion to size_t wraps the value to near SIZE_MAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer. A flaw was found in FFmpeg. This occurs due to improper bounds checking in the TY demuxer's demux_audio() function, leading to heap corruption. Successful exploitation can result in arbitrary code execution, allowing the attacker to take control of the affected system. Red Hat Enterprise Linux has multiple layers of heap protection. NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-65703] Arbitrary code execution via crafted AVI file in TDSC video decoder
FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution. A flaw was found in FFmpeg, a widely used multimedia framework. Successful exploitation can lead to a system crash and potentially enable the attacker to execute arbitrary code. Red Hat Enterprise Linux has multiple layers of heap protection. NX/DEP (Non-Executable Memory) prevents code execution from heap, thus mitigating the code execution part of the exploit. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-64785] HTTP Request Smuggling and Response Splitting via Incomplete Header Validation
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters, such as carriage return (CR) and line feed (LF), to reach an HTTP/1.1 backend, potentially bypassing security controls and enabling malicious manipulation of web requests or responses. This vulnerability in SwiftNIO HTTP/2, which could lead to HTTP request smuggling or response splitting due to incomplete header validation, does not affect Red Hat products. Red Hat's analysis indicates that the affected component is not present or not configured in a vulnerable manner within supported offerings. Red Hat severity: Low — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-93. Red Hat lists Red Hat Hardened Images as not affected.
Medium [CVE-2026-65010] Arbitrary file write via symlink following
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in shared-cache environments, enabling overwrite of sensitive files and potential privilege escalation or code execution. A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract(). When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. Datasets is vulnerable to symlink following during archive extraction in Extractor.extract(). A local attacker with low privileges who can pre-plant symlinks at predictable output paths, and who can induce extraction (user interaction), may overwrite arbitrary filesystem locations. Red Hat severity: Moderate — CVSS 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Exploit Intelligence; Lightspeed Core; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-65920] Information disclosure via path traversal vulnerability
Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading. A flaw was found in Diffusers. This could lead to information disclosure. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-65698] Sensitive file exfiltration via AI agent path traversal vulnerability
Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file:// URIs through the read_file, ls_dir, get_dir_tree, and search_* tools, which lack workspace confinement and bypass the approval gate, enabling silent exfiltration of sensitive files such as SSH private keys or cloud credentials via subsequent tool calls. An attacker who can inject instructions into content the agent processes may read arbitrary host files and exfiltrate sensitive data such as SSH keys or cloud credentials. A remote attacker who can get malicious instructions into agent-processed content (user interaction, high attack complexity) may read files outside the workspace via absolute paths or file:// URIs and exfiltrate them through later tool calls. Affects Void through 1.3.4. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Logging Subsystem for Red Hat OpenShift; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Hardened Images as not affected.
Medium [CVE-2026-54422] Credential extraction from bootc container deployment via /proc/1/root
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it. During bootc image deployment, the OCI registry pull secret was exposed to tenant-controlled container code running with host PID namespace visibility. A malicious bootc container image could read the operator's registry credentials from the host filesystem via /proc/1/root, leading to credential disclosure. This could allow a project-scoped tenant to extract shared operator registry credentials, potentially affecting multiple nodes and projects. Red Hat OpenStack Platform ships ironic-python-agent as part of its bare metal provisioning infrastructure. Deployments that use the bootc deploy_interface are affected by this vulnerability when operator-sourced registry pull secrets are used. The bootc deployment feature was introduced in more recent versions of ironic-python-agent. Older versions of Red Hat OpenStack Platform that ship ironic-python-agent versions prior to 10.2.0 are not affected as they do not contain bootc deployment support. Red Hat severity: Important — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-522. Affected Red Hat products: Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-43823] Denial of Service due to double-free during RSA public key initialization
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1. When an RSA (Rivest-Shamir-Adleman) public key is initialized from DER (Distinguished Encoding Rules) or PEM (Privacy-Enhanced Mail) formatted bytes, and an error occurs during the decoding process, a double-free vulnerability can be triggered. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-763. Affected Red Hat products: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:45784, RHSA-2026:45785.
Medium [CVE-2026-16733] bahmutov find-cypress-specs: OS Command Injection via Branch Argument Manipulation
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. A local attacker can exploit a vulnerability in the Branch Handler component by manipulating the '--branch' argument. This manipulation leads to an operating system (OS) command injection, allowing the attacker to execute arbitrary commands on the system. This could result in unauthorized access, modification, or disruption of data and system resources. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-78. Affected Red Hat products: OpenShift Pipelines; Red Hat AMQ Broker 7. Red Hat does not currently list a fixing RHSA for this CVE.