Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-16560] heap-buffer-overflow in rdn_av_swap on quoted multivalued RDN
A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another call to refer to the same memory pointer causing a denial of service or an arbitrary memory write operation. Red-hat rates this vulnerability as Moderate impact. The function can allow an unauthenticated attacker to send malformed DN requests and trigger the bug. Denial of service is more reliably observed when heap debugging is enabled (for example AddressSanitizer or MALLOC_CHECK_=3), or depending on heap layout and subsequent memory allocator activity. There is no configuration switch to disable DN normalization for client-supplied DNs. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1220. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: 389-ds-base.
Medium [CVE-2026-44192] Remote Code Execution and Data Exfiltration via Path Traversal
A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the user's system. This can result in the exposure of sensitive host information and enable the attacker to execute malicious commands, potentially leading to a full system compromise. This can lead to critical host data exfiltration or staged remote code execution when a user initiates an Ansible Execution Environment build, enabling access to sensitive host files or execution of malicious commands. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. The vulnerable code does not exist in any AAP-shipped artifact. Red Hat severity: Moderate — CVSS 6.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L). Weakness: CWE-22. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
Medium [CVE-2026-65602] Information disclosure and integrity bypass via IngressRouteTCP cross-provider reference
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7. Red Hat OpenShift Dev Spaces ships a version of traefik affected by this vulnerability. Exploitation requires specific Kubernetes RBAC permissions and a crossProviderNamespaces configuration with cross-provider TCPServersTransport resources. Red Hat severity: Moderate — CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). Weakness: CWE-863. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2020-10698 +1] websocket EventConsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698. This flaw affects all versions of Ansible Automation Platform that ship the Controller component (formerly Ansible Tower). Exploitation requires a valid authenticated user account on the AWX/Controller instance, but no specific role or organization membership is needed. The attacker receives stdout and event metadata in real time for inventory updates, project updates, and system jobs across all organizations. In multi-tenant deployments (including managed services), this allows one tenant's users to observe another tenant's job output. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-862. Affected Red Hat products: Red Hat Ansible Automation Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-10723] Incorrect acceptance of NSEC3 records
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. Exploitation requires high attack complexity, limiting the immediate risk to Red Hat products. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 9 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2026:55437, RHSA-2026:60383, RHSA-2026:54509, RHSA-2026:54654, RHSA-2026:54510, RHSA-2026:55442, RHSA-2026:57189, RHSA-2026:55441, RHSA-2026:54071. Affected products named by the advisory: Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-10822] Key Record using PRIVATEDNS algorithm may lead to exit
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:54071. Affected products named by the advisory: Red Hat package: bind9.16; Red Hat package: bind9.18; Red Hat package: dhcp.
Medium [CVE-2026-16566] jenkins_credential module returns generated API token in plaintext output
A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-56444] Denial of Service due to incorrect client reply accounting with specific serve-expired configuration
In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. A Denial of Service (DoS) flaw exists in Unbound under specific serve-expired and discard-timeout configurations. By sending crafted queries, a remote attacker can exhaust an internal counter, causing the server to drop new legitimate client queries and degrade resolution services. This Low-impact flaw in Unbound can lead to a denial of service. While a remote attacker could exhaust the reply address counter with specially crafted queries, Red Hat products are not affected by default.
Low [CVE-2026-54478] DNS Cookie security bypass via incorrect server cookie calculation
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place. A flaw was found in Unbound. When Unbound is configured to listen on a proxy-protocol port with DNS cookies enabled, it incorrectly computes the server cookie using the proxy's network address instead of the actual client's address. This Low impact flaw in Unbound occurs when the DNS resolver is configured to use both `proxy-protocol-port` and `answer-cookie: yes`. The server cookie is incorrectly derived from the proxy's address, enabling an off-path attacker to bypass DNS Cookie security by replaying a harvested cookie. This vulnerability requires a specific, non-default configuration and has high attack complexity, limiting its impact. Red Hat severity: Low — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-303.
Low [CVE-2026-50046] Denial of Service due to freed pointer dereference in DNS-over-TLS handling
Denial of Service due to freed pointer dereference in DNS-over-TLS handling. Red Hat rates this low (CVSS 3.7). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:43588 with package unbound-main-1.25.2-0.1.hum1.
Low [CVE-2026-46582] Information disclosure via DNSSEC wildcard replay
Information disclosure via DNSSEC wildcard replay. Red Hat rates this low (CVSS 3.7). Weakness: CWE-358. Red Hat lists fixing advisory RHSA-2026:43588 with package unbound-main-1.25.2-0.1.hum1.
Low [CVE-2026-42955] DNS cache integrity issue
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query. A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses. This Low impact DNS cache integrity issue in Unbound allows an attacker to extend the window for serving outdated DNS information. The risk is elevated if the non-default `harden-referral-path: yes` configuration is enabled, as it removes the need for a client query.
Low [CVE-2026-41637] Denial of Service via terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option. A flaw was found in Unbound, a Domain Name System (DNS) resolver. This vulnerability is rated as Low impact. Unbound, as distributed in Red Hat products, is not typically configured with DNS-over-QUIC (DoQ) support enabled by default. Exploitation requires Unbound to be explicitly compiled with `--with-libngtcp2` and have `quic-port` configured, in addition to an attacker bypassing default rate limits with multiple source IPs. This makes successful exploitation difficult in standard Red Hat deployments.
Low [CVE-2026-44187] Ansible Lightspeed extension for Visual Studio Code: Information disclosure of Google Gemini API key
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-256. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
High [CVE-2026-56820] Certificate revocation bypass via OCSP response replay attack
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A flaw was found in Netty. The `OcspClient` component fails to validate that the Certificate ID in an Online Certificate Status Protocol (OCSP) response matches the requested Certificate ID. This can result in the acceptance of revoked certificates, potentially compromising the integrity and confidentiality of communications. This is an Important flaw in Netty's `OcspClient` that could allow a remote attacker to bypass certificate revocation checks. Exploitation requires high attack complexity, indicating specific conditions or attacker preparation. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16; Red Hat Data Grid 8.
High [CVE-2026-56819] Denial of Service via HTTP/2 DATA frame memory leak
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). This is an Important vulnerability in Netty's HTTP/2 codec, which could lead to a denial of service. Red Hat products utilizing netty-codec-http2 with HTTP/2 content decompression enabled are susceptible to memory exhaustion when processing specially crafted HTTP/2 DATA frames.
High [CVE-2026-56817] Information disclosure via XML External Entity (XXE) vulnerability
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote attacker could exploit this vulnerability by sending specially crafted XML data containing a DOCTYPE declaration to a vulnerable XmlDecoder within the Netty channel pipeline. This can lead to an XML External Entity (XXE) vulnerability, potentially allowing the attacker to disclose sensitive information from the system. This Important flaw in Netty's `XmlDecoder` component allows for XML External Entity (XXE) injection. When a Netty channel pipeline processes XML data with a `DOCTYPE` declaration via an `AsyncXMLInputFactory` that lacks proper security configuration, a remote attacker could potentially disclose sensitive information. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-611.
High [CVE-2026-56746] Security control bypass allows unauthorized requests via null origin header
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. This could lead to a compromise of data integrity by allowing unauthorized actions. Red Hat ships Netty's netty-codec-http component in multiple products. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-807.
High [CVE-2026-56745] Denial of Service via memory exhaustion in SPDY-to-HTTP codec
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A flaw was found in Netty. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system. This is an Important denial of service vulnerability in Netty's SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772. Affected products named by the advisory: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16; Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; and 19 more.
High [CVE-2026-55851] Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion. This impact is significant for applications that process PROXY protocol v2 messages using the affected Netty component. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.