Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-59204] Denial of Service via crafted JPEG2000 image
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0. A remote attacker could exploit this vulnerability by providing a specially crafted JPEG2000 image file. Due to incorrect calculation of memory requirements for image tiles, processing this file can lead to excessive memory consumption, resulting in a denial of service (DoS) through out-of-memory failures. The impact is limited to denial of service via excessive memory allocation. A crafted JPEG2000 file can trigger out-of-memory failures, but this does not lead to code execution or information disclosure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-131. Affected Red Hat products: Red Hat AI Inference Server 3.3; Red Hat OpenShift AI 3.4; Red Hat Quay 3.1; Red Hat Quay 3.12; Red Hat Quay 3.15; Red Hat Quay 3.9; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.
High [CVE-2026-15719] Site isolation issue in the DOM: Navigation component
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-501. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-15718] Invalid pointer in the JavaScript: WebAssembly component
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Moderate — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-15416] Argo CD unauthenticated remote code execution in repo-server via GenerateManifest gRPC endpoint
A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise. Under certain conditions, an unauthenticated attacker with network access to the repo-server gRPC interface could execute arbitrary code and, as part of a multi-stage attack involving the Argo CD Redis cache, potentially compromise Kubernetes clusters managed by Argo CD. Red Hat OpenShift GitOps versions 1.20 and 1.21 are not affected by this vulnerability. As a result, the unauthenticated gRPC call path required for exploitation is not reachable from other pods in the cluster, and the attack chain cannot be initiated. Red Hat severity: Important — CVSS 8.9 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L). Weakness: CWE-306. Red Hat lists Red Hat Openshift Data Foundation 4; Red Hat OpenShift GitOps as not affected. Will not fix / out of support: Red Hat OpenShift GitOps. Red Hat fixing advisory: RHSA-2026:52857. Affected product named by the advisory: Red Hat OpenShift GitOps 1.19.
High [CVE-2026-15075] Information disclosure via improper handling of HTTP 30x redirects
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Cookie, Proxy-Authorization, and arbitrary custom headers such as X-API-Token, are forwarded to the redirect destination without the caller's knowledge. An attacker who can cause a Vert.x HttpClient to issue a request that is redirected to an attacker-controlled host (for example, by supplying a URL to a webhook dispatcher, image proxy, or microservice URL fetcher) can capture bearer tokens, basic-auth credentials, session cookies, and API keys attached to the original request. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks. This is an Important information disclosure flaw in Eclipse Vert.x's `DefaultRedirectHandler` that affects Red Hat products utilizing `vertx-core` for HTTP client operations.
High [CVE-2026-15076] Information disclosure via improper cookie domain validation
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arbitrary third-party domain; because the session store performs no cross-domain ownership check, it stores and later transmits that cookie to the targeted domain. When the victim application subsequently sends a request to the targeted domain using the same WebClientSession, it presents the attacker-injected cookie, causing the receiving service to process the request under the attacker's account. Sensitive data included in the victim application's requests, such as payment amounts, card details, or other API payloads, may then be accessible to the attacker through their own account on that service. The vulnerability arises from insufficient validation of the `Domain` attribute in `Set-Cookie` response headers, allowing a remote attacker to inject cookies scoped to arbitrary third-party domains. This could lead to sensitive data exposure and unauthorized access if a victim application subsequently sends requests to the targeted domain, presenting the attacker-controlled cookie.
High [CVE-2026-59674] Privilege escalation via symbolic link following
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from? before 8.0.5-2.1; openSUSE Tumbleweed: from? before 8.0.5-2.1. A flaw was found in suricata. This vulnerability, related to improper handling of symbolic links, allows a local `suricata` user to escalate their privileges to root. By exploiting this, an attacker could gain full control over the affected system. Red Hat's Suricata packages, built and maintained independently through Fedora and EPEL, do not contain this vulnerable packaging script and are not affected by this specific CVE. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-59.
High [CVE-2026-64600] XFS data corruption using reflink
In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently we refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but we don't refresh the data fork mapping beforehand, which means that the xfs_bmap_trim_cow in that function queries the refcount btree about the wrong physical blocks and returns an inaccurate value in *shared. If *shared is now false, the directio write proceeds with a stale data fork mapping. Fix this by querying the data fork mapping if the sequence counter changes across the ILOCK cycle. A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location, corrupting the contents of other files that reference those blocks. If properly exploited this vulnerability may lead to privilege escalations or arbitrary code execution.
Medium [CVE-2026-59732] File overwrite via path traversal during archive extraction
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4. An attacker could craft a malicious archive that, when extracted by a user, allows files to be written outside the intended destination directory. This path traversal vulnerability could lead to the creation or overwrite of other files within the same storage location, potentially compromising data integrity. Red Hat ships rclone in the VolSync component of Red Hat Advanced Cluster Management for Kubernetes (RHACM). All shipped versions are affected by this path traversal vulnerability in rclone's archive extraction functionality. Exploitation requires a user to actively run `rclone archive extract` on an attacker-supplied malicious archive. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L). Weakness: CWE-22. Will not fix / out of support: Red Hat Advanced Cluster Management for Kubernetes 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-48125] Denial of Service via crafted Client Hints header
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10. A flaw was found in UAParser.js, a JavaScript library for detecting client information. This can cause excessive CPU usage due to a regular expression denial-of-service (ReDoS) issue, leading to a denial of service for the affected application. Mobile browsers send this hint to inform servers about the specific device model. Servers use the model name to tailor content, apply device-specific optimizations, or log analytics about which hardware models access a service. A single request with a ~32,000-character model value can consume over 400ms of CPU time, with parsing time growing polynomially with input length. The impact is availability only, there is no confidentiality or integrity impact. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1333.
Medium [CVE-2026-49476] Denial of Service via crafted CSS selector string
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup.select() /.select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4. An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition. It requires the application to accept untrusted CSS selectors supplied in one of the following sinks: * soupsieve.compile() * BeautifulSoup.select() * BeautifulSoup.select_one() This is an uncommon scenario. Red Hat severity: Important — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift AI 3.4; Exploit Intelligence; Lightspeed Core; and 9 more.
Medium [CVE-2026-49854] Information disclosure via out-of-bounds read in websocket_mask
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active. This issue is fixed in version 6.5.6. This allowed the C function to read beyond the intended buffer, potentially exposing up to three bytes of uninitialized memory. This vulnerability can be triggered when the native extension is active and Tornado's Cross-Site Request Forgery (XSRF) token decoder is in use, leading to information disclosure. This Moderate vulnerability in the Tornado web framework's optional native extension, `tornado.speedups`, could lead to information disclosure. When the native extension is active and the XSRF token decoder is in use, an out-of-bounds read of up to three bytes of uninitialized memory may occur. This limited data exposure is contingent on specific configurations and does not directly lead to broader system compromise. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-125.
Medium [CVE-2026-15778] Insufficient validation of untrusted input in Navigation
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Moderate — CVSS 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-1289.
Medium [CVE-2026-15771] Insufficient validation of untrusted input in Media
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-125.
Medium [CVE-2026-15770] Uninitialized Use in V8
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) An uninitialized use flaw was found in the V8 component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-824.
Medium [CVE-2026-49459] Cross-site scripting bypass allows arbitrary script execution
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6. A remote attacker could exploit a vulnerability in the `DOMPurify.sanitize` function when used with the `IN_PLACE: true` option. Successful exploitation could lead to the execution of arbitrary scripts in the user's browser, potentially compromising user data or session integrity. Successful exploitation requires a specific application configuration where untrusted HTML is processed in this manner, allowing malicious event handlers to persist and execute arbitrary scripts. Red Hat products are generally not affected by default configurations, as this specific usage pattern is uncommon. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-79. Affected products named by the advisory: Migration Toolkit for Virtualization; Node HealthCheck Operator; OpenShift Lightspeed; OpenShift Service Mesh 3; and 10 more.
Medium [CVE-2026-49458] Cross-site scripting due to improper sanitization of DOM nodes
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6. When processing certain types of web page elements, DOMPurify failed to properly identify and sanitize malicious code. This oversight could allow an attacker to inject and execute harmful scripts within a user's web browser, potentially leading to information disclosure or unauthorized actions. This Moderate cross-site scripting (XSS) flaw in DOMPurify arises when the `DOMPurify.sanitize()` function is used with the `IN_PLACE: true` option on DOM nodes originating from a different realm (e.g., an iframe). This misconfiguration bypasses critical sanitization checks, allowing executable markup to persist. Red Hat products utilizing DOMPurify in this specific manner could be vulnerable to information disclosure or unauthorized actions if processing untrusted content. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-79.
Medium [CVE-2026-47423] Cross-site scripting vulnerability allows information disclosure
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside is returned. This issue is fixed in version 3.4.5. Due to the default allowance of `selectedcontent`, a remote attacker could craft a malicious payload that, after initial sanitization, could be re-cloned by browsers, leading to the execution of unsanitized markup. This could result in information disclosure. User interaction is required for exploitation. * AC was raised from Low to High because exploitation requires specific browser support for the experimental HTML element, which is currently only available in Chromium 148+ and WebKit 625+. No Red Hat product ships dompurify 3.4.4. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-79. Affected Red Hat products: Red Hat Hardened Images; Red Hat Ceph Storage 9; Red Hat Openshift Data Foundation 4.
Medium [CVE-2026-15714] Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string
An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata. This vulnerability presents a moderate risk to confidentiality and availability for software implementations implementing libsoup for multipart payload handling. Because the memory tracking misalignment happens during the automated header ingestion phase, an attacker can seamlessly induce a crash remotely without needing local context or user interaction. Red Hat Product Security ranks this as a notable security regression within parsing utilities, though impact vectors generally manifest as localized client or server session instability rather than complete remote code execution. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-125.
Medium [CVE-2026-15713] HTTP/2 frame window exhaustion remote denial of service via memory leak
A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash. This flaw poses a moderate availability impact to applications leveraging libsoup for modern HTTP/2 communications. Because the memory leakage accrues iteratively over standard session handling paths, an attacker can reliably cause a service disruption without needing local system privileges or user interaction. Red Hat Product Security notes that while the impact is bounded to a local application process termination, it remains a severe reliability risk for persistent cloud daemons or desktop clients communicating over untrusted wide-area network nodes. Red Hat severity: Low — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-772.